ISO 42001 requirements: clauses and Annex A controls

The structure of ISO 42001

ISO 42001 uses the same harmonised high-level structure as ISO 27001 and ISO 9001, so its requirements sit in clauses 4 to 10. Clauses 1–3 cover scope, references and terms; the auditable requirements begin at clause 4.

The management-system clauses (4–10)

• Clause 4 — Context: define the scope of your AI management system and understand the internal and external issues and interested parties.
• Clause 5 — Leadership: top-management ownership, an AI policy, and clear roles and responsibilities.
• Clause 6 — Planning: AI risk assessment and treatment, AI impact assessment, and objectives.
• Clause 7 — Support: resources, competence, awareness, communication and documented information.
• Clause 8 — Operation: putting the controls into practice across the AI lifecycle, including the risk and impact assessments.
• Clause 9 — Performance evaluation: monitoring, internal audit and management review.
• Clause 10 — Improvement: corrective action and continual improvement.

The Annex A controls

Alongside the clauses, Annex A provides a reference set of AI-specific controls you select and implement based on your risks. They span areas such as AI policies; internal organisation and roles; resources for AI systems (data, tooling, human oversight); AI impact assessment; the AI system lifecycle from design to retirement; data management and quality; information and transparency for users; and the responsible use and third-party or supplier management of AI. You record which controls apply, and why, in a Statement of Applicability.

AI impact assessment: the requirement people miss

A defining requirement of ISO 42001 is the AI system impact assessment — evaluating the consequences of an AI system on individuals and groups, not just on the organisation. This, alongside the risk assessment, is where most of the real work sits, and where auditors look closely.

How the requirements map to certification

Meeting these requirements is exactly what a certification audit checks — Stage 1 reviews your documentation and readiness, Stage 2 tests that the system operates in practice. See how to get ISO 42001 certified and work through the ISO 42001 checklist.

How AramGRC helps

AramGRC's ISO/IEC 42001 gap assessment scores your organisation against every clause and Annex A control and hands you a prioritised roadmap to close the gaps.